LetsDefend

NEW YORK, September 16, 2025--Hack The Box (HTB), a global leader in gamified cybersecurity skills development, today announced that it has acquired LetsDefend, a pioneering blue team upskilling platform known for its hands-on SOC simulations and growing

We have collected, processed and stored logs up to this point. Now, we need to detect abnormal behavior using the data we have and generate alerts. If you did not read old posts, you can check it:

The first place where the generated logs are sent is the log aggregator. We can edit the logs coming here before sending them to the destination. For example, if we want to get only status codes from a web server logs, we can filter among the incoming log

To put it simply, a process running code in the address space of another process is called process injection. Attackers and malware often make use of the "Process Injection" technique. Thanks to this technique, they can increase the success rate of the at

Incident response is an approach to managing a security incident process. An incident response plan is needed to approach security incidents systematically. A successful incident response plan includes the following 6 stages

We constantly spend time analyzing malware. We have listed 29 addresses that can be useful for blue team members to use time more effectively:

It is the approach of analyzing malicious software by reverse engineering methods without running them. Generally, by decompile / disassemble the malware, each step that the malware will execute is analyzed, hence the behavior / capacity of the malware ca

In this article, basically explained log collection for SIEM. It contains a basic log, time, source system and a message. For example, when we look at the content of the "/var/log/auth.log" file on an Ubuntu server, we can see the source, time and message

After a cyber incident, data must be collected to investigate and protect evidence. Collecting data is sensitive process, should not cause the target to collapse and data corruption. Therefore, We need to make minimum changes on the target system while co

In order to ensure to cyber security of an organization, the logs of the systems it owns must be collected, analyzed and repeated continuously. For provide the continuous of the process, monitoring systems can be installed. The fact that what is happening